package com.dragonfly.shutter.controllers;

import java.util.regex.Pattern;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.ModelAttribute;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.SessionAttributes;
import org.springframework.web.servlet.ModelAndView;

import com.dragonfly.shutter.beans.Message;
import com.dragonfly.shutter.beans.PictureDetail;
import com.dragonfly.shutter.services.AddCommentService;
import com.dragonfly.shutter.utils.KeywordFilter;

/**
 * 添加评论控制器
 * @author 控制器
 *
 */
@Controller
@RequestMapping("/addComment.html")
@SessionAttributes("validateCode")
public class AddCommentController {
	@Autowired
	private AddCommentService addCommentService;

	@RequestMapping( method = RequestMethod.POST)
	public ModelAndView onLoad(HttpSession session, HttpServletRequest request,
			@RequestParam(value="commentContent", required=false) String commentContent,
			@RequestParam(value="pictureID", required=false) String pictureID,
			@RequestParam(value="ownerID", required=false) String ownerIDStr,
			@RequestParam(value="validateCodeImg", required=false) String validateCodeImg,
			@ModelAttribute("validateCode") String validateCode
			){
		Message message = null;
		@SuppressWarnings("unused")
		PictureDetail picture = null;
		Integer userID = (Integer)session.getAttribute("userID");
		
		//空的参数
		if(pictureID == null || ownerIDStr == null || validateCodeImg == null){
			message = new Message("空的参数", "操作失败", "/Dragonfly");
			return new ModelAndView("message", "message", message);
		}
		
		//非法的参数(要求为数值组成)
		if(!KeywordFilter.isNumeric(pictureID) || !KeywordFilter.isNumeric(ownerIDStr)){
			message = new Message("非法的参数", "操作失败", "/Dragonfly");
			return new ModelAndView("message", "message", message);
		}
		
		//错误的验证码
		if(!validateCode.equals(validateCodeImg.toUpperCase())){
			message = new Message("验证码填写错误", "操作失败", "picture.html?pictureID="+pictureID);
			return new ModelAndView("message", "message", message);
		}
		
		//空的字符内容
		if(commentContent == null || commentContent.trim().equals("")){
			message = new Message("请在评论中添加内容", "操作失败", "picture.html?pictureID="+pictureID);
			return new ModelAndView("message", "message", message);
		}
		
		//SQL注入
		if(Pattern.matches("select|update|delete|exec|count|'|\"|=|;|>|<|%", commentContent)){
			message = new Message("请不要在评论内容中输入SQL关键字", "操作失败", "picture.html?pictureID="+pictureID);
			return new ModelAndView("message", "message", message);
		}
		
		//若添加评论的用户为游客
		if(userID == null){
			userID = new Integer(0);
		}
		
		try {
			picture = addCommentService.doService(pictureID, commentContent, userID, request.getRequestURL().toString());
		} catch (Exception e) {
			// 给不存在的图片添加评论
			e.printStackTrace();
			message = new Message(e.getMessage(), "操作失败", "/Dragonfly");
			return new ModelAndView("message", "message", message);
		}
		
		return new ModelAndView("redirect:/picture.html?pictureID=" + pictureID);
	}
}
